nerdexam
EC-Council

312-50V10 · Question #21

Which of the following will perform an Xmas scan using NMAP?

The correct answer is C. nmap -sX 192.168.1.254. The nmap -sX flag triggers an Xmas scan, which sets the FIN, PSH, and URG TCP flags simultaneously, named for the way a packet lit with multiple flags resembles a Christmas tree.

Scanning Networks

Question

Which of the following will perform an Xmas scan using NMAP?

Options

  • Anmap -sA 192.168.1.254
  • Bnmap -sP 192.168.1.254
  • Cnmap -sX 192.168.1.254
  • Dnmap -sV 192.168.1.254

How the community answered

(41 responses)
  • A
    5% (2)
  • B
    2% (1)
  • C
    88% (36)
  • D
    5% (2)

Why each option

The nmap -sX flag triggers an Xmas scan, which sets the FIN, PSH, and URG TCP flags simultaneously, named for the way a packet lit with multiple flags resembles a Christmas tree.

Anmap -sA 192.168.1.254

nmap -sA performs an ACK scan used to map firewall rule sets, not an Xmas scan.

Bnmap -sP 192.168.1.254

nmap -sP performs a ping scan for host discovery, not an Xmas scan.

Cnmap -sX 192.168.1.254Correct

The -sX flag in Nmap performs an Xmas scan by setting the FIN, PSH, and URG flags in the TCP packet header. On closed ports, RFC-compliant systems respond with a RST packet, while open or filtered ports produce no response. This technique is used for stealthy port scanning because it does not complete a full TCP handshake.

Dnmap -sV 192.168.1.254

nmap -sV performs service and version detection, not an Xmas scan.

Concept tested: Nmap Xmas scan flag and TCP packet manipulation

Source: https://nmap.org/book/man-port-scanning-techniques.html

Topics

#Xmas scan#NMAP#port scanning#TCP flags

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice